How to return error code & message from the custom WIF based SecurityTokenService when user authentication fails?

Question

I am building my custom Security Token Service inheriting from the Windows Identity Foundation's SecurityTokenService .

However, I do not find any appropriate method which I can use to inform client application about the authentication failure details when authentication fails.

In case of WIF based custom STS, how to inform client about authentication failure and the reason (error code/message) of the failure? There is no method which returns boolean True or False.

I can throw some exception, but is it a recommended way?

It seems clients always expect some Claims in the object STS returns. But when authentication is failed, how come there will be any Claim? Or which Claims to return when authentication is failed?

I went through many WIF related samples available on various forums, but nothing helped me to answer my queries.

Answer 1

It's not the right thing to return some Claims of the user who is not authenticated ! Claims are not meant for this purpose. So returning some claim (which tells about authentication failure) is not the solution.

About 500 status code:

When error is reported by the WCF service using Fault Contract/Exception, 500 is the default HTTP status code used. So if you see the 500 status code, it's not an error; it's expected.

Having said this, you can change the status code by writing your custom service behavior and the class which implements IErrorHandler .

Refer to this post . It gave me these inputs.